Plaintext passwords in error.log #1311

New Issue

GiteaMirror · 2025-11-02T03:56:21-06:00

GiteaMirror commented

2025-11-02 03:56:21 -06:00

Originally created by @issmirnov on GitHub (Dec 1, 2017).

Gitea version (or commit ref): 1.3.0 (possibly earlier too)
Git version: n/a
Operating system: Ubuntu 16.04
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant

Description

While debugging a a separate issue, I checked log/error.log/gitea.log. imagine my horror when I saw plaintext usernames and passwords in the log.

This is not OK. Error level logs are enabled by default, stored in a folder owned by the gitea user. Any vulnerability in gitea that would grant access to those logs instantly gives access to all passwords ever entered. Additionally, any exploit of the server gives access to this as well.

I haven't checked how passwords are stored, but I fervently hope that are hashed with salt rather than plaintext in SQL.

log sample

Username, password and repo redacted for privacy.

2017/12/01 11:10:37 [...odels/repo_mirror.go:252 SyncMirrors()] [E] Failed to update mirror repository '/home/git/gitea-repositories/redacted/redacted.git': remote: Invalid username or password.
fatal: Authentication failed for 'https://redacted:redacted@github.com/redacted/redacted.git/'
error: Could not fetch origin

Originally created by @issmirnov on GitHub (Dec 1, 2017). - Gitea version (or commit ref): 1.3.0 (possibly earlier too) - Git version: n/a - Operating system: Ubuntu 16.04 - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant ## Description While debugging a a separate issue, I checked `log/error.log/gitea.log`. imagine my horror when I saw plaintext usernames and passwords in the log. This is not OK. Error level logs are enabled by default, stored in a folder owned by the gitea user. Any vulnerability in gitea that would grant access to those logs instantly gives access to all passwords ever entered. Additionally, any exploit of the server gives access to this as well. I haven't checked how passwords are stored, but I fervently hope that are hashed with salt rather than plaintext in SQL. ## log sample Username, password and repo redacted for privacy. ``` 2017/12/01 11:10:37 [...odels/repo_mirror.go:252 SyncMirrors()] [E] Failed to update mirror repository '/home/git/gitea-repositories/redacted/redacted.git': remote: Invalid username or password. fatal: Authentication failed for 'https://redacted:redacted@github.com/redacted/redacted.git/' error: Could not fetch origin ```

GiteaMirror added the topic/security label 2025-11-02 03:56:21 -06:00

GiteaMirror closed this issue

2025-11-02 03:56:21 -06:00

GiteaMirror commented

2025-11-02 03:56:22 -06:00

@ethantkoenig commented on GitHub (Dec 2, 2017):

@issmirnov Agreed that this is a serious vulnerability. We will investigate.

For the record, passwords are salted and hashed; we do not store plaintext passwords in the DB.

@ethantkoenig commented on GitHub (Dec 2, 2017): @issmirnov Agreed that this is a serious vulnerability. We will investigate. For the record, passwords are salted and hashed; we do not store plaintext passwords in the DB.

GiteaMirror commented

2025-11-02 03:56:22 -06:00

@issmirnov commented on GitHub (Dec 2, 2017):

@ethantkoenig - thank you for the quick response and clarification about DB password storage. Looking forward to a fix.

@issmirnov commented on GitHub (Dec 2, 2017): @ethantkoenig - thank you for the quick response and clarification about DB password storage. Looking forward to a fix.

GiteaMirror commented

2025-11-02 03:56:22 -06:00

@issmirnov commented on GitHub (Dec 3, 2017):

Thank you!!

@issmirnov commented on GitHub (Dec 3, 2017): Thank you!!

GiteaMirror referenced this issue

2025-11-02 06:29:25 -06:00

Problems with the new release 1.11.7 #5577

GiteaMirror referenced this issue

2025-11-02 06:29:35 -06:00

Update to 1.12.0: #5579

GiteaMirror referenced this issue